GHSA-2WQP-Q3C6-CCJ5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

Summary MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm...

CVE-2026-115886 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party...

CVE-2026-115886

The MLflow AI engineering platform (versions 3.12.0rc0 to 3.17.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The issue exists in the scorer invoke, register, and GenAI evaluate endpoints (specifically unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke). The root cause is that Sco...